DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2526

trm_detach tears down DMA/IOPORT resources before bus_teardown_intr interrupt handler can execute against freed memory during detach

Summary

trm_detach releases IOPORT frees SRB SG lists and SRB array destroys sense_buffers allocation then only calls bus_teardown_intr. Interrupt fired between bus_release_resource(IOPORT) and bus_teardown_intr runs trm_Interrupt which reads/writes already-freed memory (sense_buffers via trm_get_sense_buf pFreeSRB via trm_GetSRB DCBarray). Window 3696-3710 wide open. trm_Interrupt walks pACB->pActiveDCB pDCB->pActiveSRB pSRB->pccb (points into freed SRB array) trm_get_sense_buf dereferences freed sense_buffers.

Discussion (0)

No comments yet.